Page 760 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

FIGURE 11.7 The TCP three-way handshake

When a communication session is complete, there are two methods to
disconnect the TCP session. First, and most common, is the use of FIN

(finish) flagged packets instead of SYN flagged packets. Each side of a
conversation will transmit a FIN flagged packet once all of its data is
transmitted, triggering the opposing side to confirm with an ACK
flagged packet. Thus, it takes four packets to gracefully tear down a
TCP session. Second is the use of an RST (reset) flagged packet, which
causes an immediate and abrupt session termination. (Please see the

discussion of the TCP header flag later in this section.)

The segments of a TCP transmission are tagged with a sequence
number. This allows the receiver to rebuild the original
communication by reordering received segments back into their
proper arrangement in spite of the order in which they were received.
Data communicated through a TCP session is periodically verified with

an acknowledgment. The acknowledgment is sent by the receiver back
to the sender by setting the TCP header’s acknowledgment sequence
value to the last sequence number received from the sender within the
transmission window. The number of packets transmitted before an